A CVE Is Not an Answer to "Are We Affected?"
When a serious CVE lands, "do we use it?" is the first question. It isn't the answer a CTO, customer or board needs. The questions that follow decide what you patch first.
Did the Next.js Patch Reach Every App?
Next.js has fixed two unauthenticated remote code execution bugs. Patching the main app is the easy part. The app that gets hit is usually the one nobody remembers owning.
Where Do PHP and Node Actually Run?
PHP2Shell and Node2Shell are both on CISA's list of exploited vulnerabilities. Before you can patch, you need to know where the runtimes are, and the official Docker images hide them from most scans.